@shardworks/claude-code-apparatus 0.1.269 → 0.1.271

package/README.md

@@ -55,24 +55,20 @@ import {
 
 ### Rate-Limit Detection
 
-The provider runs a three-stage detection cascade to identify rate-limited terminations and attach a structured `terminationTag` to the session result. The Animator's back-off state machine consumes the tag and transitions its status book accordingly.
+The provider runs a **two-branch NDJSON detector** to identify rate-limited terminations and attach a structured `terminationTag` to the session result. The Animator's back-off state machine consumes the tag and transitions its pause-state doc accordingly.
 
 ```typescript
-import {
-  detectRateLimitFromNdjson,
-  detectRateLimitFromStderr,
-  detectRateLimitFromExitCode,
-  RATE_LIMIT_EXIT_CODE,
-} from '@shardworks/claude-code-apparatus';
+import { detectRateLimitFromNdjson } from '@shardworks/claude-code-apparatus';
 ```
 
-Cascade order (first-wins):
+Active detector branches (first-wins):
+
+1. **Structural `subtype`** — `parseStreamJsonMessage` inspects every NDJSON message whose `subtype` contains `rate_limit` / `rate-limit` and emits a tag with `source: 'ndjson-result'`.
+2. **Structural `is_error`** — if `msg.is_error === true` and the carried error text matches the rate-limit phrasing regex, the same tag is produced.
 
-1. **NDJSON inspection** — `parseStreamJsonMessage` checks every NDJSON message for a rate-limit `subtype`, an `is_error: true` message whose error text matches the pattern, or a `result` message text match.
-2. **Stderr pattern match** — the babysitter's stderr observer samples each chunk for a forgiving rate-limit regex (`rate limit`, `429`, `usage limit`, `quota exceeded`, `too many requests` — case-insensitive). Scope is narrow: detection only; the babysitter does not forward the full stderr buffer to the guild.
-3. **Distinguished exit code** — if neither of the above fired and `claude` exits with `RATE_LIMIT_EXIT_CODE`, the provider still promotes the result to `rate-limited`.
+Everything else surfaces as plain `failed`. The previous stderr-pattern and exit-code branches were retired after two production incidents where an assistant's prose summary / a generic non-zero exit code tripped a false-positive pause. Generic non-zero exit codes surface as `'failed'`; the babysitter no longer samples claude's stderr for pattern matches, only forwards it to the per-session log file.
 
-Generic non-zero exit codes surface as plain `failed` — rate-limit detection is deliberately conservative.
+When a non-zero exit arrives without an NDJSON termination tag, the babysitter captures a `terminationDiagnostic: { exitCode, stderrExcerpt? }` on the session-record payload so operators can review the signal that fell through — without the Animator widening its pause gate on it.
 
 ## Session Babysitter
 

package/dist/babysitter.d.ts

@@ -13,71 +13,25 @@
  * The babysitter is a detached process: it survives guild restarts.
  * All guild communication is via HTTP (tool server) and SQLite (transcripts).
  *
+ * The single-purpose primitives (stdin parsing, retrying HTTP, DLQ writes,
+ * the SQLite trio, lifecycle reporters, stderr redirect) live in
+ * `runtime.ts`. This file owns the orchestrator (`runBabysitter`), the
+ * MCP/SSE proxy, and the script entry point. The previously-exported
+ * primitives are re-exported below to preserve the package's public
+ * surface.
+ *
  * See: docs/architecture/detached-sessions.md
  */
 import { spawn } from 'node:child_process';
-import { type StreamJsonResult } from './index.ts';
-import type { SessionTerminationTag } from '@shardworks/animator-apparatus';
-/** A serialized tool definition as received in the babysitter config. */
-export interface SerializedTool {
-    /** Tool name (e.g. 'writ-list'). */
-    name: string;
-    /** Tool description. */
-    description: string;
-    /** JSON Schema for the tool's input parameters. */
-    params: Record<string, unknown>;
-    /**
-     * HTTP method the guild tool server routes this tool under. The MCP proxy
-     * uses this to avoid POSTing to a GET-only read-tool route (which would
-     * 404). Derived from the tool's `permission` by `permissionToMethod()`.
-     */
-    method: 'GET' | 'POST' | 'DELETE';
-}
-/** Config written to the babysitter's stdin by the spawning process. */
-export interface BabysitterConfig {
-    sessionId: string;
-    guildToolUrl: string;
-    dbPath: string;
-    logDir: string;
-    claudeArgs: string[];
-    cwd: string;
-    env: Record<string, string>;
-    prompt: string;
-    tools: SerializedTool[];
-    startedAt: string;
-    provider: string;
-    metadata?: Record<string, unknown>;
-    /** Temp directory for the system prompt file. Cleaned up in finally block. */
-    systemPromptTmpDir?: string;
-}
-/**
- * Walk an error's cause chain looking for a retryable error code.
- * Returns the first retryable code found, or null if none.
- * Caps traversal depth to prevent infinite loops from circular cause chains.
- */
-export declare function findRetryableCode(err: unknown, maxDepth?: number): string | null;
+import { type BabysitterConfig, type SerializedTool, type TranscriptDb } from './runtime.ts';
+export { callGuildHttpApi, findRetryableCode, initTranscriptDb, openTranscriptDb, readConfigFromStdin, redirectStderrToFile, reportResult, reportRunning, resolveTerminalStatus, STDERR_DIAGNOSTIC_TAIL_LIMIT, writeToDlq, writeTranscript, } from './runtime.ts';
+export type { BabysitterConfig, SerializedTool, TranscriptDb, } from './runtime.ts';
 export interface McpProxyHandle {
     /** URL for --mcp-config (e.g. "http://127.0.0.1:PORT/sse"). */
     url: string;
     /** Shut down the HTTP server and MCP transport. */
     close(): Promise<void>;
 }
-/**
- * Read the babysitter config from stdin.
- *
- * Reads stdin to completion, parses the JSON, and validates required fields.
- * The spawning process writes config and closes the write end.
- */
-export declare function readConfigFromStdin(stream?: NodeJS.ReadableStream): Promise<BabysitterConfig>;
-export declare function callGuildHttpApi(url: string, sessionId: string, body: unknown, timeoutMs?: number, method?: 'GET' | 'POST' | 'DELETE'): Promise<unknown>;
-/**
- * Write a payload to the Dead Letter Queue.
- *
- * Creates the DLQ directory if it doesn't exist. Writes the payload as
- * pretty-printed JSON. Used as a fallback when the guild HTTP API is
- * unreachable for lifecycle calls.
- */
-export declare function writeToDlq(cwd: string, filename: string, payload: unknown): void;
 /**
  * Create an MCP/SSE HTTP server that proxies tool calls to the guild.
  *
@@ -88,92 +42,6 @@ export declare function writeToDlq(cwd: string, filename: string, payload: unkno
  * JSON Schema (the serialized params from the config).
  */
 export declare function createProxyMcpHttpServer(tools: SerializedTool[], guildToolUrl: string, sessionId: string): Promise<McpProxyHandle>;
-/** Minimal interface for the SQLite database used by the babysitter. */
-export interface TranscriptDb {
-    /** Write a transcript entry (id, content JSON). */
-    writeTranscript(sessionId: string, content: string): void;
-    /** Close the database connection. */
-    close(): void;
-}
-/**
- * Open the guild's SQLite database for transcript streaming.
- *
- * Creates the database file and table if they don't exist.
- * Enables WAL mode for concurrent read access by other processes
- * (Oculus, CLI queries, other agents).
- *
- * Uses dynamic import() to load better-sqlite3 at runtime. This avoids
- * requiring the native module at import time (beneficial for type-checking
- * and testing).
- */
-export declare function openTranscriptDb(dbPath: string): Promise<TranscriptDb>;
-/**
- * Initialize a TranscriptDb from a Database constructor.
- *
- * Shared logic between openTranscriptDb() and test injection.
- * Exported for testing — allows injecting a mock Database constructor.
- */
-export declare function initTranscriptDb(DatabaseConstructor: new (path: string) => {
-    pragma(stmt: string): unknown;
-    prepare(sql: string): {
-        run(...params: unknown[]): void;
-    };
-    exec(sql: string): void;
-    close(): void;
-}, dbPath: string): TranscriptDb;
-/**
- * Write the current transcript to SQLite.
- */
-export declare function writeTranscript(db: TranscriptDb, sessionId: string, messages: Record<string, unknown>[]): void;
-/**
- * Report "running" status to the guild via the session-running tool.
- *
- * If the guild is unreachable, writes the payload to the DLQ.
- */
-export declare function reportRunning(config: BabysitterConfig, cancelHandle: Record<string, unknown>, timeoutMs?: number): Promise<void>;
-/**
- * Resolve the terminal status and error text for a terminated session,
- * giving rate-limit detection precedence over the generic exit-code
- * mapping.
- *
- * Cascade order (D5):
- *   1. A `'cancelled'` override (SIGTERM path) — short-circuits.
- *   2. A `terminationTag` already carried on the StreamJsonResult —
- *      set by the NDJSON-level cascade (first-wins across NDJSON and
- *      stderr observations in the babysitter).
- *   3. A distinguished rate-limit exit code (RATE_LIMIT_EXIT_CODE).
- *   4. Generic exit-code mapping (0 → completed, non-zero → failed).
- *
- * Returns both the payload status, a human-readable error string (only
- * populated for the failed branches), and the tag that informed the
- * decision (if any). The tag is forwarded to the guild so the Animator's
- * back-off machine can disambiguate rate-limit terminations without
- * pattern-matching on error text.
- */
-export declare function resolveTerminalStatus(result: StreamJsonResult, statusOverride?: 'cancelled'): {
-    status: 'completed' | 'failed' | 'cancelled' | 'rate-limited';
-    error?: string;
-    terminationTag?: SessionTerminationTag;
-};
-/**
- * Report the final session result to the guild via the session-record tool.
- *
- * If the guild is unreachable, writes the payload to the DLQ.
- */
-export declare function reportResult(config: BabysitterConfig, result: StreamJsonResult, transcript: Record<string, unknown>[], timeoutMs?: number, statusOverride?: 'cancelled'): Promise<void>;
-/**
- * Open a per-session log file and redirect process.stderr.write to it.
- *
- * Creates the logDir (recursive) and opens `<logDir>/<sessionId>.log`
- * for append-writing. Replaces process.stderr.write with a function
- * that calls fs.writeSync on the owned fd. Writes the startup banner
- * as the first line.
- *
- * Returns the owned fd so the caller can close it in a finally block.
- *
- * @internal Exported for testing only.
- */
-export declare function redirectStderrToFile(logDir: string, sessionId: string): number;
 /**
  * Run the session babysitter.
  *

package/dist/babysitter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"babysitter.d.ts","sourceRoot":"","sources":["../src/babysitter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAgB9D,OAAO,EAML,KAAK,gBAAgB,EACtB,MAAM,YAAY,CAAC;AAEpB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAI5E,yEAAyE;AACzE,MAAM,WAAW,cAAc;IAC7B,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,wBAAwB;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC;;;;OAIG;IACH,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAC;CACnC;AAED,wEAAwE;AACxE,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,8EAA8E;IAC9E,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AASD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,GAAE,MAAU,GAAG,MAAM,GAAG,IAAI,CAUnF;AAID,MAAM,WAAW,cAAc;IAC7B,+DAA+D;IAC/D,GAAG,EAAE,MAAM,CAAC;IACZ,mDAAmD;IACnD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAID;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,GAAE,MAAM,CAAC,cAA8B,GAC5C,OAAO,CAAC,gBAAgB,CAAC,CAiC3B;AAoCD,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,MAAM,EACX,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,OAAO,EACb,SAAS,GAAE,MAAyB,EACpC,MAAM,GAAE,KAAK,GAAG,MAAM,GAAG,QAAiB,GACzC,OAAO,CAAC,OAAO,CAAC,CAgDlB;AAID;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,IAAI,CAOhF;AAID;;;;;;;;GAQG;AACH,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,cAAc,EAAE,EACvB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,cAAc,CAAC,CAmLzB;AAID,wEAAwE;AACxE,MAAM,WAAW,YAAY;IAC3B,mDAAmD;IACnD,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1D,qCAAqC;IACrC,KAAK,IAAI,IAAI,CAAC;CACf;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAG5E;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,mBAAmB,EAAE,KAAK,IAAI,EAAE,MAAM,KAAK;IACzC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9B,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG;QAAE,GAAG,CAAC,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAA;KAAE,CAAC;IAC1D,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,KAAK,IAAI,IAAI,CAAC;CACf,EACD,MAAM,EAAE,MAAM,GACb,YAAY,CAqBd;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,EAAE,EAAE,YAAY,EAChB,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAClC,IAAI,CAGN;AAID;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,gBAAgB,EACxB,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACrC,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,gBAAgB,EACxB,cAAc,CAAC,EAAE,WAAW,GAC3B;IAAE,MAAM,EAAE,WAAW,GAAG,QAAQ,GAAG,WAAW,GAAG,cAAc,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,qBAAqB,CAAA;CAAE,CAkC3H;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,gBAAgB,EACxB,MAAM,EAAE,gBAAgB,EACxB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EACrC,SAAS,CAAC,EAAE,MAAM,EAClB,cAAc,CAAC,EAAE,WAAW,GAC3B,OAAO,CAAC,IAAI,CAAC,CAyBf;AAID;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CA+B9E;AAID;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,gBAAgB,EACxB,IAAI,CAAC,EAAE;IACL,yEAAyE;IACzE,EAAE,CAAC,EAAE,YAAY,CAAC;IAClB,kCAAkC;IAClC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB,8DAA8D;IAC9D,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GACA,OAAO,CAAC,IAAI,CAAC,CA8Nf"}
+{"version":3,"file":"babysitter.d.ts","sourceRoot":"","sources":["../src/babysitter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAwB9D,OAAO,EAUL,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,YAAY,EAClB,MAAM,cAAc,CAAC;AAItB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,mBAAmB,EACnB,oBAAoB,EACpB,YAAY,EACZ,aAAa,EACb,qBAAqB,EACrB,4BAA4B,EAC5B,UAAU,EACV,eAAe,GAChB,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,gBAAgB,EAChB,cAAc,EACd,YAAY,GACb,MAAM,cAAc,CAAC;AAItB,MAAM,WAAW,cAAc;IAC7B,+DAA+D;IAC/D,GAAG,EAAE,MAAM,CAAC;IACZ,mDAAmD;IACnD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAID;;;;;;;;GAQG;AACH,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,cAAc,EAAE,EACvB,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,cAAc,CAAC,CAmLzB;AAID;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,gBAAgB,EACxB,IAAI,CAAC,EAAE;IACL,yEAAyE;IACzE,EAAE,CAAC,EAAE,YAAY,CAAC;IAClB,kCAAkC;IAClC,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;IACvB,8DAA8D;IAC9D,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,GACA,OAAO,CAAC,IAAI,CAAC,CAqOf"}

package/dist/babysitter.js

@@ -13,6 +13,13 @@
  * The babysitter is a detached process: it survives guild restarts.
  * All guild communication is via HTTP (tool server) and SQLite (transcripts).
  *
+ * The single-purpose primitives (stdin parsing, retrying HTTP, DLQ writes,
+ * the SQLite trio, lifecycle reporters, stderr redirect) live in
+ * `runtime.ts`. This file owns the orchestrator (`runBabysitter`), the
+ * MCP/SSE proxy, and the script entry point. The previously-exported
+ * primitives are re-exported below to preserve the package's public
+ * surface.
+ *
  * See: docs/architecture/detached-sessions.md
  */
 import { spawn } from 'node:child_process';
@@ -25,153 +32,10 @@ import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { ListToolsRequestSchema, CallToolRequestSchema, } from '@modelcontextprotocol/sdk/types.js';
 import { SSEServerTransport } from '@modelcontextprotocol/sdk/server/sse.js';
 import { toolNameToRoute } from '@shardworks/tools-apparatus';
-import { processNdjsonBuffer, parseStreamJsonMessage, extractFinalAssistantText, detectRateLimitFromStderr, detectRateLimitFromExitCode, } from "./index.js";
-// ── Retry constants ─────────────────────────────────────────────────────
-const RETRY_INITIAL_DELAY_MS = 1_000;
-const RETRY_MAX_DELAY_MS = 8_000;
-const RETRY_TIMEOUT_MS = 60_000;
-const RETRYABLE_CODES = new Set(['ECONNREFUSED', 'ECONNRESET', 'ETIMEDOUT']);
-/**
- * Walk an error's cause chain looking for a retryable error code.
- * Returns the first retryable code found, or null if none.
- * Caps traversal depth to prevent infinite loops from circular cause chains.
- */
-export function findRetryableCode(err, maxDepth = 5) {
-    let current = err;
-    for (let i = 0; i < maxDepth && current != null; i++) {
-        const code = current.code;
-        if (code && RETRYABLE_CODES.has(code)) {
-            return code;
-        }
-        current = current.cause;
-    }
-    return null;
-}
-// ── stdin config reader ─────────────────────────────────────────────────
-/**
- * Read the babysitter config from stdin.
- *
- * Reads stdin to completion, parses the JSON, and validates required fields.
- * The spawning process writes config and closes the write end.
- */
-export async function readConfigFromStdin(stream = process.stdin) {
-    const chunks = [];
-    for await (const chunk of stream) {
-        chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
-    }
-    const raw = Buffer.concat(chunks).toString('utf-8');
-    if (!raw.trim()) {
-        throw new Error('Empty config received on stdin');
-    }
-    let parsed;
-    try {
-        parsed = JSON.parse(raw);
-    }
-    catch {
-        throw new Error(`Invalid JSON config on stdin: ${raw.slice(0, 200)}`);
-    }
-    const config = parsed;
-    // Validate required fields
-    const required = [
-        'sessionId', 'guildToolUrl', 'dbPath', 'logDir', 'claudeArgs',
-        'cwd', 'env', 'prompt', 'tools', 'startedAt', 'provider',
-    ];
-    for (const field of required) {
-        if (config[field] === undefined || config[field] === null) {
-            throw new Error(`Missing required config field: ${field}`);
-        }
-    }
-    return config;
-}
-// ── HTTP retry helper ───────────────────────────────────────────────────
-/**
- * Call a guild HTTP API endpoint with exponential backoff retry.
- *
- * Retries on connection errors (ECONNREFUSED, ECONNRESET, ETIMEDOUT).
- * Returns the parsed JSON response on success.
- * Throws after RETRY_TIMEOUT_MS of retrying.
- */
-/**
- * Encode a params object as a query string for GET requests.
- *
- * Scalars (string/number/boolean) become their string form. Arrays and
- * objects are JSON-encoded so the tool-server can still parse them after
- * its param coercion pass (though read-tools generally take scalar
- * inputs). null/undefined values are skipped.
- */
-function encodeParamsAsQuery(params) {
-    if (params == null || typeof params !== 'object')
-        return '';
-    const usp = new URLSearchParams();
-    for (const [key, value] of Object.entries(params)) {
-        if (value == null)
-            continue;
-        if (typeof value === 'string') {
-            usp.set(key, value);
-        }
-        else if (typeof value === 'number' || typeof value === 'boolean') {
-            usp.set(key, String(value));
-        }
-        else {
-            usp.set(key, JSON.stringify(value));
-        }
-    }
-    const s = usp.toString();
-    return s.length > 0 ? `?${s}` : '';
-}
-export async function callGuildHttpApi(url, sessionId, body, timeoutMs = RETRY_TIMEOUT_MS, method = 'POST') {
-    const startTime = Date.now();
-    let delay = RETRY_INITIAL_DELAY_MS;
-    let lastError;
-    // GET can't carry a body — encode params as query string instead.
-    const targetUrl = method === 'GET' ? `${url}${encodeParamsAsQuery(body)}` : url;
-    const requestBody = method === 'GET' ? undefined : JSON.stringify(body);
-    while (Date.now() - startTime < timeoutMs) {
-        try {
-            const response = await fetch(targetUrl, {
-                method,
-                headers: {
-                    'Content-Type': 'application/json',
-                    'X-Session-Id': sessionId,
-                },
-                ...(requestBody !== undefined ? { body: requestBody } : {}),
-            });
-            if (!response.ok) {
-                const text = await response.text().catch(() => '');
-                throw new Error(`HTTP ${response.status}: ${text.slice(0, 500)}`);
-            }
-            return await response.json();
-        }
-        catch (err) {
-            lastError = err instanceof Error ? err : new Error(String(err));
-            // Check if the error is retryable (connection-level error in the cause chain)
-            const isRetryable = findRetryableCode(err) !== null;
-            if (!isRetryable) {
-                throw lastError;
-            }
-            // Wait before retrying
-            const remaining = timeoutMs - (Date.now() - startTime);
-            if (remaining <= 0)
-                break;
-            await new Promise((resolve) => setTimeout(resolve, Math.min(delay, remaining)));
-            delay = Math.min(delay * 2, RETRY_MAX_DELAY_MS);
-        }
-    }
-    throw new Error(`Guild HTTP API unreachable after ${timeoutMs}ms: ${lastError?.message ?? 'unknown error'}`);
-}
-// ── DLQ writer ──────────────────────────────────────────────────────────
-/**
- * Write a payload to the Dead Letter Queue.
- *
- * Creates the DLQ directory if it doesn't exist. Writes the payload as
- * pretty-printed JSON. Used as a fallback when the guild HTTP API is
- * unreachable for lifecycle calls.
- */
-export function writeToDlq(cwd, filename, payload) {
-    const dlqDir = path.join(cwd, '.nexus', 'dlq');
-    fs.mkdirSync(dlqDir, { recursive: true });
-    fs.writeFileSync(path.join(dlqDir, filename), JSON.stringify(payload, null, 2));
-}
+import { processNdjsonBuffer, parseStreamJsonMessage, } from "./index.js";
+import { callGuildHttpApi, openTranscriptDb, readConfigFromStdin, redirectStderrToFile, reportRunning, reportResult, STDERR_DIAGNOSTIC_TAIL_LIMIT, writeToDlq, writeTranscript, } from "./runtime.js";
+// ── Re-exports (preserves the pre-extraction public surface) ────────────
+export { callGuildHttpApi, findRetryableCode, initTranscriptDb, openTranscriptDb, readConfigFromStdin, redirectStderrToFile, reportResult, reportRunning, resolveTerminalStatus, STDERR_DIAGNOSTIC_TAIL_LIMIT, writeToDlq, writeTranscript, } from "./runtime.js";
 // ── MCP proxy server ────────────────────────────────────────────────────
 /**
  * Create an MCP/SSE HTTP server that proxies tool calls to the guild.
@@ -342,190 +206,6 @@ export async function createProxyMcpHttpServer(tools, guildToolUrl, sessionId) {
         },
     };
 }
-/**
- * Open the guild's SQLite database for transcript streaming.
- *
- * Creates the database file and table if they don't exist.
- * Enables WAL mode for concurrent read access by other processes
- * (Oculus, CLI queries, other agents).
- *
- * Uses dynamic import() to load better-sqlite3 at runtime. This avoids
- * requiring the native module at import time (beneficial for type-checking
- * and testing).
- */
-export async function openTranscriptDb(dbPath) {
-    const { default: Database } = await import('better-sqlite3');
-    return initTranscriptDb(Database, dbPath);
-}
-/**
- * Initialize a TranscriptDb from a Database constructor.
- *
- * Shared logic between openTranscriptDb() and test injection.
- * Exported for testing — allows injecting a mock Database constructor.
- */
-export function initTranscriptDb(DatabaseConstructor, dbPath) {
-    const raw = new DatabaseConstructor(dbPath);
-    raw.pragma('journal_mode = WAL');
-    raw.exec(`
-    CREATE TABLE IF NOT EXISTS books_animator_transcripts (
-      id      TEXT PRIMARY KEY,
-      content TEXT NOT NULL
-    )
-  `);
-    const stmt = raw.prepare('INSERT OR REPLACE INTO books_animator_transcripts (id, content) VALUES (?, ?)');
-    return {
-        writeTranscript(sessionId, content) {
-            stmt.run(sessionId, content);
-        },
-        close() {
-            raw.close();
-        },
-    };
-}
-/**
- * Write the current transcript to SQLite.
- */
-export function writeTranscript(db, sessionId, messages) {
-    const content = JSON.stringify({ id: sessionId, messages });
-    db.writeTranscript(sessionId, content);
-}
-// ── Session lifecycle reporting ─────────────────────────────────────────
-/**
- * Report "running" status to the guild via the session-running tool.
- *
- * If the guild is unreachable, writes the payload to the DLQ.
- */
-export async function reportRunning(config, cancelHandle, timeoutMs) {
-    const route = toolNameToRoute('session-running');
-    const url = `${config.guildToolUrl}${route}`;
-    const payload = {
-        sessionId: config.sessionId,
-        startedAt: config.startedAt,
-        provider: config.provider,
-        metadata: config.metadata,
-        cancelHandle,
-    };
-    try {
-        await callGuildHttpApi(url, config.sessionId, payload, timeoutMs);
-    }
-    catch {
-        writeToDlq(config.cwd, `${config.sessionId}-running.json`, payload);
-    }
-}
-/**
- * Resolve the terminal status and error text for a terminated session,
- * giving rate-limit detection precedence over the generic exit-code
- * mapping.
- *
- * Cascade order (D5):
- *   1. A `'cancelled'` override (SIGTERM path) — short-circuits.
- *   2. A `terminationTag` already carried on the StreamJsonResult —
- *      set by the NDJSON-level cascade (first-wins across NDJSON and
- *      stderr observations in the babysitter).
- *   3. A distinguished rate-limit exit code (RATE_LIMIT_EXIT_CODE).
- *   4. Generic exit-code mapping (0 → completed, non-zero → failed).
- *
- * Returns both the payload status, a human-readable error string (only
- * populated for the failed branches), and the tag that informed the
- * decision (if any). The tag is forwarded to the guild so the Animator's
- * back-off machine can disambiguate rate-limit terminations without
- * pattern-matching on error text.
- */
-export function resolveTerminalStatus(result, statusOverride) {
-    if (statusOverride === 'cancelled') {
-        return { status: 'cancelled' };
-    }
-    // Second priority: a structural tag observed by the NDJSON/stderr
-    // cascades. Fire even on exit code 0 because claude may emit the
-    // rate-limit signal and still exit cleanly.
-    if (result.terminationTag) {
-        return {
-            status: 'rate-limited',
-            error: result.terminationTag.detail ?? `Anima provider reported a rate limit (source: ${result.terminationTag.source})`,
-            terminationTag: result.terminationTag,
-        };
-    }
-    // Third priority: distinguished exit code.
-    const exitCodeTag = detectRateLimitFromExitCode(result.exitCode);
-    if (exitCodeTag) {
-        return {
-            status: 'rate-limited',
-            error: exitCodeTag.detail,
-            terminationTag: exitCodeTag,
-        };
-    }
-    if (result.exitCode === 0) {
-        return { status: 'completed' };
-    }
-    return {
-        status: 'failed',
-        error: `claude exited with code ${result.exitCode}`,
-    };
-}
-/**
- * Report the final session result to the guild via the session-record tool.
- *
- * If the guild is unreachable, writes the payload to the DLQ.
- */
-export async function reportResult(config, result, transcript, timeoutMs, statusOverride) {
-    const route = toolNameToRoute('session-record');
-    const url = `${config.guildToolUrl}${route}`;
-    const resolved = resolveTerminalStatus(result, statusOverride);
-    const output = extractFinalAssistantText(transcript);
-    const payload = {
-        sessionId: config.sessionId,
-        status: resolved.status,
-        exitCode: result.exitCode,
-        signal: result.signal,
-        error: resolved.error,
-        costUsd: result.costUsd,
-        tokenUsage: result.tokenUsage,
-        output,
-        providerSessionId: result.providerSessionId,
-        transcript,
-        ...(resolved.terminationTag ? { terminationTag: resolved.terminationTag } : {}),
-    };
-    try {
-        await callGuildHttpApi(url, config.sessionId, payload, timeoutMs);
-    }
-    catch {
-        writeToDlq(config.cwd, `${config.sessionId}.json`, payload);
-    }
-}
-// ── Stderr redirect ────────────────────────────────────────────────────
-/**
- * Open a per-session log file and redirect process.stderr.write to it.
- *
- * Creates the logDir (recursive) and opens `<logDir>/<sessionId>.log`
- * for append-writing. Replaces process.stderr.write with a function
- * that calls fs.writeSync on the owned fd. Writes the startup banner
- * as the first line.
- *
- * Returns the owned fd so the caller can close it in a finally block.
- *
- * @internal Exported for testing only.
- */
-export function redirectStderrToFile(logDir, sessionId) {
-    fs.mkdirSync(logDir, { recursive: true });
-    const logFilePath = path.join(logDir, `${sessionId}.log`);
-    const fd = fs.openSync(logFilePath, 'a');
-    // Replace process.stderr.write with a function that writes to our fd.
-    process.stderr.write = function (chunk, encodingOrCallback, callback) {
-        const encoding = typeof encodingOrCallback === 'string' ? encodingOrCallback : 'utf8';
-        const cb = typeof encodingOrCallback === 'function' ? encodingOrCallback : callback;
-        const buffer = typeof chunk === 'string'
-            ? Buffer.from(chunk, encoding)
-            : chunk;
-        fs.writeSync(fd, buffer);
-        if (cb)
-            cb();
-        return true;
-    };
-    // Write the startup banner (now goes to the log file).
-    const pgid = process.getgid?.() ?? process.pid;
-    process.stderr.write(`[babysitter] session=${sessionId} pid=${process.pid} pgid=${pgid} log=${logFilePath} started at ${new Date().toISOString()}\n`);
-    return fd;
-}
 // ── Main babysitter function ────────────────────────────────────────────
 /**
  * Run the session babysitter.
@@ -581,21 +261,20 @@ export async function runBabysitter(config, deps) {
             claudeProc.stdin.write(config.prompt);
         }
         claudeProc.stdin.end();
-        // Sample claude's stderr for rate-limit phrasing (narrow: pattern
-        // detection only, not general forwarding to the guild) then forward
-        // the raw bytes to the babysitter's redirected stderr log.
+        // Forward claude's stderr bytes to the babysitter's redirected
+        // stderr log. No detection happens here — rate-limit signals are
+        // detected only on structured NDJSON messages inside
+        // parseStreamJsonMessage.
         //
-        // First-wins: the NDJSON cascade runs inside parseStreamJsonMessage,
-        // so this branch only populates the tag when nothing more structured
-        // fired. That keeps the stderr pattern from masking the more
-        // informative NDJSON `source: 'ndjson-result'` tag in the common case.
+        // Also maintain a rolling tail buffer (last
+        // STDERR_DIAGNOSTIC_TAIL_LIMIT chars) — used as the `stderrExcerpt`
+        // of the passive `terminationDiagnostic` attached when the session
+        // ends with `'failed'`. O(1) per chunk: append then slice the tail.
+        let stderrTail = '';
         claudeProc.stderr?.on('data', (chunk) => {
-            if (!acc.terminationTag) {
-                const tag = detectRateLimitFromStderr(chunk.toString());
-                if (tag)
-                    acc.terminationTag = tag;
-            }
             process.stderr.write(chunk);
+            const text = chunk.toString('utf8');
+            stderrTail = (stderrTail + text).slice(-STDERR_DIAGNOSTIC_TAIL_LIMIT);
         });
         // 5. Report "running" status (don't await — fire and forget with retry)
         const cancelHandle = { kind: 'local-pgid', pgid: process.pid };
@@ -684,7 +363,7 @@ export async function runBabysitter(config, deps) {
             ...(acc.terminationTag ? { terminationTag: acc.terminationTag } : {}),
         };
         // 8. Report result
-        await reportResult(config, result, acc.transcript, retryTimeoutMs, cancelledBySignal ? 'cancelled' : undefined);
+        await reportResult(config, result, acc.transcript, retryTimeoutMs, cancelledBySignal ? 'cancelled' : undefined, stderrTail);
     }
     catch (err) {
         // Top-level error: attempt to report failure